CVE-2026-35512

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6

Description An open source RDP server contains a heap-based buffer overflow in the EGFX (graphics dynamic virtual channel) implementation. This occurs due to insufficient validation of client-controlled size parameters, which allows an out-of-bounds write via crafted PDUs (Protocol Data Units). Pre-authentication exploitation can cause the process to crash, while post-authentication exploitation may lead to remote code execution.

Recommendations Update to version 0.10.6. Run xrdp as a non-privileged user to limit the impact of successful exploitation.